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DETAILED ACTION 

Claims 1-21 are pending. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 13-14 are rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

Claim 13 recites the limitation "the compressed destination address" in lines 4-5. 
However, there is insufficient antecedent basis for this limitation in the claim. The 
examiner suggests amending the claim to recite the limitation "the destination address" 
for proper correction. For the purposes of prior art rejections the claim has been 
interpreted with the aforementioned limitation. 

Claim 14 recites the limitation "compressed source addresses" in line 4. 
However, there insufficient antecedent basis for this claim. The examiner suggests 
amending the claim to recite the limitation "source addresses" for proper correction. . 
For the purposes of prior art rejections the claim has been interpreted with the 
aforementioned limitation. 
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Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21 (2) 
of such treaty in the English language. 

Claims 1-2, 7-10,13-16, and 18-21 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Copeland, III (US Patent Application Publication 
2002/0144156), hereinafter referred to as Copeland. 

In reference to claim 1, Copeland discloses a packet identifier method involving 
assigning data packets to various flows between a source (i.e. client) and destination 
(i.e. server) within a network (paragraph [0018], line 1 to [0019], line 9 and paragraph 
[0179], lines 7-8). The collected data for each flow is subsequently analyzed to 
determine unauthorized network activity (paragraph [0033], lines 1-18). The packet 
identifier method is disclosed as: 

♦ A method for identifying a flow if data between a source and a destination in a 

network said method comprising the steps of, (paragraph [0018], lines 1-3;paragraph 
[0053], lines 1-3; paragraph [0091], lines 1-3; paragraph [0179], lines 7-8;Figure 9A): 
o Identifying a plurality of packets (Figure 1-item 101) at a first point 
(Figure 1-item 155) and a second point (Figure 2-item 150) in the 
network, (paragraph [0041], lines 1-14; paragraph 0053], line 1 to 
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[0054], line 4; paragraph [0057], lines 5-8; paragraph [0059], line 1 to 
[0061], line 11; and Figure 1-2); 
o Comparing a source address of each packet identified at the second 
point with one or more source addresses of packets identified at the 
first point (i.e. stored in flow data structure Figure 1-item 162); and if 
one of the compared source addresses matches, identifying a 
destination address of the corresponding packet identified at the 
second point, and associating (i.e. assigning) the identified destination 
address and the matching source address to a flow between the 
source and destination (paragraph [0059], line 6 to [0061], line 3; 
paragraph [0053], line 1 to [0055], line 11; paragraph [0139], lines 1- 
13; paragraph [0142], lines 1-6; paragraph [0180], line 1 to [0181], line 
8). 



In reference to claim 2, Copeland discloses the aforementioned packet identifier 

as: 

• A method for identifying a flow if data between a source and a destination in a 
network said method comprising the steps of, (paragraph [0018], lines 1- 
3;paragraph [0053], lines 1-3; paragraph [0091], lines 1-3; paragraph [0179], 
lines 7-8;Figure 9A): 

o Identifying a plurality of packets (Figure 1-item 101) at a first point 
(Figure 1-item 155) and a second point (Figure 2-item 150) in the 
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network (Figures 1&2-item 199), (paragraph [0041], lines 1-14; 
paragraph 0053], line 1 to [0054], line 4; paragraph [0057], lines 5-8; 
paragraph [0059], line 1 to [0061], line 1 1; and Figure 1-2); 
o Comparing a destination address of each packet identified at the first 
point with one or more destination addresses of packets identified at 
the second point; and if one of the compared destination addresses 
matches, identifying a source address of the corresponding packet 
identified at the first point (i.e. stored in flow data structure Figure 1- 
item 162), and associating (i.e. assigning) the identified source 
address and the matching destination address to a flow between the 
source and destination, (paragraph [0059], line 6 to [0061], line 3; 
paragraph [0053], line 1 to [0055], line 11; paragraph [0139], lines 1- 
13; paragraph [0142], lines 1-6; paragraph [0180], line 1 to [0181], line 
8). 

In reference to claim 13, Copeland explicitly discloses a system for executing the 
aforementioned packet identifier method, (paragraph [0173], lines 1-10). Specifically, 
the system comprises a network monitoring appliance (Figure 2-item 150) that includes 
a port profiling engine (Figure 1-item 155) located at multiple points in the network 
(paragraph [0054], lines 1-3 and paragraph [0057], lines 1-8), and a database (Figure 1- 
item 160) that includes a flow data structure (Figure 1-item 162), (paragraph [0131], 
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lines 1-6 and paragraph [0137], lines 1-3). The aforementioned system is disclosed by 
Copeland as: 

• A system for identifying a flow of data between a source and a 
destination in a network comprising, (paragraph [0173], lines 1- 
10; paragraph [0018], line 1 to [0019], line 9; paragraph [0176], 
lines 1-3; and paragraph [0179], lines 7-8): 

• A first processor (Figure 2-item 1 50) that identifies a 
destination address of one or more packets flowing 
through a second point in the network and sends the 
destination addresses to a first point (i.e. via the flow data 
structure Figure 1-item 162) in the network, (paragraph 
[0173], lines 1-10;paragraph [0176], lines 1-8; Figure 8- 
item 850; paragraph [0060], lines 1-3; [0139], lines 1-5; 
[0137], lines 1-7); 

• A second processor (Figure 1-item 155) that identifies a 
destination address of a packet flowing through the first 
point, receives the destination addresses from the first 
processor (via the flow data structure Figure 1-item 162), 
and generates flow information based on a comparison 
between the destination addresses received from the first 
processor and the destination addresses of the packet 
identified at the second processor, wherein the flow 
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information identifies the flow of packets between the first 
point and the second point, (paragraph [0053], line 1 to 
paragraph [0055], line 11; paragraph [0139], lines 1-5; 
paragraph [0142], lines 1-6). 



In reference to claim 14, Copeland discloses the aforementioned system as: 

• A system for identifying a flow of data between a source and a 

destination in a network comprising, (paragraph [0173], lines 1- 

10; paragraph [0018], line 1 to [0019], line 9; paragraph [0176], 

lines 1-3; and paragraph [0179], lines 7-8): 

• A first processor (Figure 1-item 155) that identifies a source 
address of one or more packets flowing through a first point 
in the network, and sends the source addresses to a second 
point (i.e. via the flow data structure Figure 1-item 162) in the 
network, (paragraph [0173], lines 1-10;paragraph [0176], 
lines 1-8; Figure 8-item 850; paragraph [0053], line 1 to 
paragraph [0055], line 11; paragraph [0139], lines 1-5; 
paragraph [0137], lines 1-7); and 

• A second processor (Figure 2-item 150) that identifies a 
source address of a packet flowing through the second 
point, receives source addresses from the first processor 
(i.e. via the flow data structure Figure 1-item 162), and 
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generates flow information based on a comparison 
between the source addresses received from the first 
processor and the source address of the packet identified 
at the second processor, wherein the flow information 
identifies the flow of packets between the first point and 
the second point, (paragraph [0060], lines 1-3; paragraph 
[0139], lines 1-5; paragraph [0142], lines 1-6). 

In reference to claim 15, Copeland explicitly discloses a method, specifically a 
thread identifier method, comprising: 

• Receiving a first set of information (i.e. new packet), (paragraph [0180], lines 1-3; 
paragraph [0139], lines 1-3); 

• Receiving a second set of information (i.e. flow data structure information), 
(paragraph [0181], lines 1-8; paragraph [0139], lines 3-5); 

• Generating a match value (i.e. hash value) from the first set of information and 
the second set of information, (paragraph [181], lines 3-8; paragraph [0139], lines 
5-9); and generating a flow entry based upon the match value, (paragraph 
[0189], lines 1-7; and paragraph [0142], lines 1-5). 

In reference to claim 18, Copeland explicitly discloses a method, specifically a 
packet identifier method, comprising: 
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Comparing a first destination address (i.e. new packet) with a second destination 
address (i.e. flow data structure information) to generate a match value (i.e. hash 
value), (paragraph [0180], lines 1-3; paragraph [0181], lines 1-8); and 
Generating a flow entry based upon the match value, (paragraph [0189], lines 1-7). 

In reference to claim 20, Copeland discloses a method, specifically a packet 
identifier method, comprising: 

• Comparing a first source address (i.e. new packet) with a second source address 
(i.e. flow data structure information) to generate a match value (i.e. hash value), 
(paragraph [0180], lines 1-3; paragraph [0181], lines 1-8); and 

• Generating a flow entry based upon the match value, (paragraph [0189], lines 1- 
7). 

In reference to claim 7, Copeland shows the packet identifier method to 
further comprise generating flow information at the first point (Figure 1-item 155) based 
on the matched destination address and the identified source address, (paragraph 
[0053], linel to [0055], line 11; paragraph [0139], lines 1-5; paragraph [0142], lines 1-6). 

In reference to claim 8, Copeland shows the packet identifier method 
sending the flow information (i.e. via the flow data structure) generated at the first point 
(Figure 1-item 155) to the second point (Figure 2-item 150), (paragraph [0060], lines 1- 
3; paragraph [0137], lines 1-16; and Figure 6). 
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In reference claim 9, Copeland shows the packet identifier method 
updating the flow information (i.e. via the flow data structure) at the first point (Figure 1- 
item 155) when a new destination address is identified at the second point, (paragraph 
[0060], lines 1-3; paragraph [0053], line 1 line 11; paragraph [0139], lines 1-5; 
paragraph [0142], lines 1-6; paragraph [0179], lines 7-9). 

In reference to claim 10, Copeland shows the packet identifier method 
updating the flow information at the first and second point when a destination address 
(i.e. flow record) is purged (i.e. cleared) at the second point after a predetermined time- 
out-period, (paragraph [0157], lines 1-7; paragraph [0160], line 1 to paragraph [0161], 
line 3). 

In reference to claim 16, Copeland shows the packet identifier method 
wherein: the first set of information (i.e. new packet) comprises a first source address 
and a first destination address, (paragraph [0041], lines 1-5; Figure item 3-item 310); 
and the second set of information comprises a second source address and a second 
destination address, (paragraph [0055], lines 1-11; [0139], lines 1-3; Figure 1-item 162); 
the match value (i.e. hash value) is based upon the first destination address and the 
second destination address, (paragraph [0139], lines 1-13); and the flow entry indicates 
the information is flowing between a first node associated with the first set of information 
and a second node associated with the second set of information, (paragraph [0018], 
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lines 1-10; paragraph [0053], line 1 to [0055], line 11; paragraph [0139], lines 1-3; and 
paragraph [0142], lines 1-6). 

In reference to claim 19, Copeland shows the packet identifier method 
wherein the flow entry indicates that information is flowing between a first node 
associated with the first destination address and a second node associated with the 
second destination address, (paragraph [0018], lines 1-10; paragraph [0053], line 1 to 
[0055], line 11; paragraph [0139], lines 1-3; and paragraph [0142], lines 1-6). 

In reference to claim 21 , Copeland shows the packet identifier method 
wherein the flow entry indicates that information is flowing between a first node 
associated with the first source address and a second node associated with the second 
source address, (paragraph [0018], lines 1-10; paragraph [0053], line 1 to [0055], line 
11; paragraph [0139], lines 1-3; and paragraph [0142], lines 1-6). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was 
made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall 
not be negatived by the manner in which the invention was made. 

Claims 11, 12 and 17 rejected under 35 U.S.C. 103(a) as being unpatentable 

over Copeland, III as applied to the claims above, and further in view of Vanlint 
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(US Patent Application Publication 2001/0050903), hereinafter referred to as 
Vanlint. 

In reference to claim 1 1 , Copeland discloses substantial features of the claimed 
invention. As previously evidenced in reference to claims 1, Copeland discloses a 
method comprising the steps of: identifying a plurality of packets at a first point and a 
second point in the network; comparing a destination address of each packet 
identified at the first point with a destination address of one or more packets 
identified at the second point; and if one of the compared destination addresses 
matches, then identifying a source address of the corresponding packet identified at 
the first point, associating the identified source address and the matching destination 
address to a flow between the source and destination (see claim 2 rejection). 
Copeland further discloses TCP/IP packets with an associated time-to-live value in 
the packet header (Figure 3-item 310). However the reference fails to disclose: 
determining a direction of a flow of data between a source and a destination in a 
network; selecting a time-to-live value from the plurality of packets identified at the 
first point and at least one of the plurality of packets identified at the second point; 
and comparing the time-to-live value of the packets identified at the first point and 
the at least one of the plurality of packets identified at the second point 
corresponding to the flow between the source and the destination to determine the 
direction of the flow between the source and destination. Nonetheless, these 
modifications would have been obvious to one of ordinary skill in the art at the time 
of the invention, as further evidenced by Vanlint. 
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In an analogous art, Vanlint discloses a method for calculating network latency 
that involves correlating instances of the same packet in trace files generated at a 
first network location and a second network location (paragraph [0019], lines 1-7). 
Vanlint further discloses that the aforementioned correlation comprises determining 
the transmission direction of the packets by comparing the time-to-live values of the 
common packet in multiple trace files, (paragraph [0031], line 1 to [0032], line 12; 
Figure 3-item 62). It would have been obvious to implement these modifications to 
the packet identifier method as disclosed by Copeland, because one of ordinary skill 
in the art would have been so motivated to determine the latency associated with an 
identified flow. As a result, a cause for delay can be determined through improved 
network performance analysis (Vanlint paragraph [0002], lines 5-18). 

In reference to claim 12, Copeland discloses substantial features of the claimed 
invention. As previously evidenced in reference to claim 1 , Copeland discloses a 
method comprising the steps of: identifying a plurality of packets at a first point and a 
second point in the network; comparing a source address of each packet identified 
at the second point with a source address of one or more packets identified at the 
first point; if one of the compared source addresses matches, then identifying a 
destination address of the corresponding packet identified at the second point, and 
associating the identified destination address and the matching source address to a 
flow between the source and destination, (see claim 1 rejection). Copeland further 
discloses TCP/IP packets with an associated time-to-live value in the packet header 
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(Figure 3-item 310). However the reference fails to disclose: determining a direction 
of a flow of data between a source and a destination in a network; selecting a time- 
to-live value from the plurality of packets identified at the first point and at least one 
of the plurality of packets identified at the second point; and comparing the time-to- 
live value of the packets identified at the first point and the at least one of the 
plurality of packets identified at the second point corresponding to the flow between 
the source and the destination to determine the direction of the flow between the 
source and destination. Nonetheless, these modifications would have been obvious 
to one of ordinary skill in the art at the time of the invention, as further evidenced by 
Vanlint. 

In an analogous art, Vanlint discloses a method for calculating network latency 
that involves correlating instances of the same packet in trace files generated at a first 
network location and a second network location (paragraph [0019], lines 1-7). Vanlint 
further discloses that the aforementioned correlation comprises determining the 
transmission direction of the packets by comparing the time-to-live values of the 
common packet in multiple trace files, (paragraph [0031], line 1 to [0032], line 12; Figure 
3-item 62). It would have been obvious to implement these modifications to the packet 
identifier method as disclosed by Copeland, because one of ordinary skill in the art 
would have been so motivated to determine the latency associated with an identified 
flow. As a result, a cause for delay can be determined through improved network 
performance analysis (Vanlint paragraph [0002], lines 5-18). 
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In reference to claim 17, although Copeland teaches the first set of information 
(TCP/IP packet) with an associated time-to-live value in the packet header (Figure 3- 
item 310), Copeland fails to teach expressly the second set of information 
comprising a second time-to-live value; the flow entry indicates the direction of 
information flowing between the first node and the second node, the flow entry 
based upon the first time-to-live value and the second time-to-live value. 
Nonetheless, these modifications would have been obvious to one of ordinary skill in 
the art at the time of the invention, as further evidenced by Vanlint. 

In an analogous art, Vanlint discloses a method for calculating network latency 
that involves correlating instances of the same packet in trace files generated at a first 
network location and a second network location (paragraph [0019], lines 1-7). Vanlint 
further discloses that the aforementioned correlation comprises determining the 
transmission direction of the packets by comparing the time-to-live values of the 
common packet in multiple trace files, (paragraph [0031], line 1 to [0032], line 12; Figure 
3-item 62). It would have been obvious to implement these modifications to the packet 
identifier method as disclosed by Copeland, because one of ordinary skill in the art 
would have been so motivated to determine the latency associated with an identified 
flow. As a result, a cause for delay can be determined through improved network 
performance analysis (Vanlint paragraph [0002], lines 5-18). 
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Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Copeland, III as applied to claims above, and further in view of Kaku (US Patent 
6,279,097), hereinafter referred to as Kaku. 

In reference to claim 3, although Copeland discloses the aforementioned packet 
identifier method comprises identifying a plurality of packets at a second point (Figure 2- 
item 150) and generating a group (i.e. flow data structure) based on the destination 
address of each packet identified at the second point, (paragraph [0041], lines 1-14; 
paragraph [0053], line 1 to [0054], line 4; paragraph [0057], lines 5-8; paragraph [0059], 
line 1 to [0061], line 11; and Figure 1-2), the reference fails to disclose generating 
compressed addresses. However, compressing IP addresses were well known in the art 
at the time of the invention, as further evidenced by Kaku. As a result, this modification 
to the method disclosed by Copeland would have been obvious to one of ordinary skill 
in the art at the time of the invention. 

In an analogous art, Kaku discloses a method for generating a lookup table that 
involves receiving an input address and resulting a compressed address, thereby 
having fewer bits than the original destination address (column 3, lines 1 -1 6 and column 
4, lines 25-34). One of ordinary skill in the art would have been so motivated to 
compress addresses that are stored in flow data structure database, in order to reduce 
the amount size required (Kaku column 2, lines 18-22). 
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Claim 4 rejected under 35 U.S.C. 103(a) as being unpatentable over 
Copeland and Kaku as applied to claims above, and further in view of Satoh et al. 
(US Patent 6,065,064), hereinafter referred to as Satoh. 

In reference to claim 4, the Copeland and Kaku show a method comprising the 
generating a compressed address group based on destination addresses identified at 
the second point (Copeland Figure 2-item 150), (Copeland paragraph [0041], lines 1-14; 
paragraph [0053], line 1 to [0054], line 4; paragraph [0057], lines 5-8; paragraph [0059], 
line 1 to [0061], line 11; and Figure 1-2; Kaku column 4, lines 25-34). However, the 
references fail to show identifying network addresses based on the destination 
addresses identified at the second point, and classifying each identified network 
address based on a range of bits in the identified network addresses. Nonetheless, 
these limitations were well known in the art at the time of the invention, as further 
evidenced by Satoh. 

In an analogous art, Satoh shows a method for routing frames within a network 
that involves identifying (i.e. extracting) network addresses from destination addresses 
contained in the IP headers, (column 2, lines 34-40). Satoh further shows classifying the 
identified network addresses based on a range (I.e. number) of bits in the identified 
network addresses, (column 2, line 49 to column 3, line 10). These modifications to the 
aforementioned would have been obvious because one of ordinary skill in the art would 
have been motivated to efficiently determine the network address of a received frame, 
thereby improving the processing speed, (Satoh column 5, lines 10-22). 
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Allowable Subject Matter 



Claims 5-6 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the 
base claim and any intervening claims. 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to LaShanya R Nash whose telephone number is (703) 
305-8910. The examiner can normally be reached on 9am-5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Glenton Burgess can be reached on (703) 305-4792. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



Conclusion 
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